[clamav-users] clamd cache (was Re: clamscan --disable-cache)

Fri Oct 2 06:02:08 UTC 2020

I'm not intimately familiar with how the scan cache works.  I believe the cache size isn't limited at all.  Adding a scan result to the cache should never fail, unless the system runs out of memory.  I also would expect your first clamDscan scan to be slower than all subsequent scans of the same files up until a clamd database reload clears the cache.  

A database check without a reload shouldn't clear the cache.  If it does, that would certainly be a bug.

I wish I had more time to dig in and investigate to help further but I'm a little overwhelmed with other tasks at present.  I'll try to keep an eye on the thread to see if something comes up that I can be of help with.

-Micah

-----Original Message-----
From: clamav-users <clamav-users-bounces at lists.clamav.net> On Behalf Of Dave Sill via clamav-users
Sent: Thursday, October 1, 2020 11:02 AM
To: G.W. Haywood via clamav-users <clamav-users at lists.clamav.net>
Cc: Dave Sill <sillde at ornl.gov>
Subject: Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

"G.W. Haywood via clamav-users" <clamav-users at lists.clamav.net> wrote:
> Hi there,
> 
> On Thu, 1 Oct 2020, Dave Sill via clamav-users wrote:
> 
> >It looks like my point was lost in the noise ...
> 
> Sorry, I guess it was late and I was in a hurry to get to bed. :(

No worries. Thanks for your help.

> >... on a much smaller scan, the cache made a huge difference. That 
> >tells me that the cache isn't large enough to significantly speed up 
> >large scans.
> 
> It might be too soon to draw that conclusion.  It's possible that the 
> daemon reloaded its database during your test, and I'd expect that to 
> cause any cached results to be discarded for obvious reasons.

Fair enough. I re-ran the same scan three times after rebooting and got the following run times:

20:46
19:37
19:18

And the clamd logs show "SelfCheck: Database status OK" every 10 minutes but no DB updates.

> >I don't see that the cache size is run-time configurable. Is that right?
> 
> Correct, but I'd thought its size would be limited only by the RAM you 
> have free.  If you look at the code in libclamav/cache.c you can see 
> that struct cache_set is just a few pointers, and if you only have 69k 
> files under your home directory I wouldn't expect storage of that many 
> sets of pointers to be an issue.
> 
> I'll dig into this a bit more when I have chance if somebody doesn't 
> beat me to it.

I only have 16 GB RAM on this system but it still shows 1 GB free.
Maybe it limits itself somehow.

-Dave

_______________________________________________

clamav-users mailing list
clamav-users at lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml